PT-2025-20515 · Linux+5 · Linux Kernel+5
Russell King
·
Published
2025-04-17
·
Updated
2026-04-20
·
CVE-2025-37865
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability in the Linux kernel has been resolved, related to the deletion of VLANs when MST is unsupported. The issue arises from the
mv88e6xxx port vlan leave() function, which attempts to find an MST entry associated with the SID but fails and returns -ENOENT. This is because some chip implementations do not populate vlan.sid, leading to the use of garbage SID values. The fix involves testing for sid == 0 to cover non-bridge VLANs or bridge VLANs mapped to the default MSTI, and adding a test for mv88e6xxx has stu() inside mv88e6xxx mst put() to avoid accessing uninitialized memory.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu